refactor: extract shared buildNoProxyEnv helper to eliminate duplicate NO_PROXY assembly

[Copilot]

NO_PROXY/no_proxy was assembled independently in three security-critical paths, each hardcoding localhost,127.0.0.1,::1 before appending service-specific bypasses — making it easy for the three to silently drift apart.

Changes

• src/services/no-proxy-utils.ts (new) — shared helpers:

  • buildNoProxyValue(additionalHosts?) → comma-joined bypass string
  • buildNoProxyEnv(additionalHosts?) → { NO_PROXY, no_proxy } object (both identical)

• api-proxy-env-config.ts — replace inline literals with ...buildNoProxyEnv()

• agent-environment/proxy-environment.ts — replace incremental string mutations with a collected noProxyHosts[] array passed once to buildNoProxyValue()

• cli-proxy-service.ts — replace inline literals with ...buildNoProxyEnv(['host.docker.internal'])

Example

Before (three divergent sites):

// api-proxy-env-config.ts
NO_PROXY: 'localhost,127.0.0.1,::1',
no_proxy: 'localhost,127.0.0.1,::1',

// proxy-environment.ts
environment.NO_PROXY = `localhost,127.0.0.1,::1,0.0.0.0,...`;
environment.no_proxy = environment.NO_PROXY;
environment.NO_PROXY += `,host.docker.internal,...`;
environment.no_proxy = environment.NO_PROXY; // easy to forget

// cli-proxy-service.ts
NO_PROXY: `localhost,127.0.0.1,::1,host.docker.internal`,
no_proxy: `localhost,127.0.0.1,::1,host.docker.internal`,

After (single source of truth):

// api-proxy-env-config.ts
...buildNoProxyEnv()

// proxy-environment.ts
const noProxyHosts = ['0.0.0.0', networkConfig.squidIp, networkConfig.agentIp];
if (config.enableHostAccess) noProxyHosts.push('host.docker.internal', gatewayIp);
if (config.enableApiProxy)   noProxyHosts.push(networkConfig.proxyIp, 'api-proxy');
environment.NO_PROXY = buildNoProxyValue(noProxyHosts);
environment.no_proxy = environment.NO_PROXY;

// cli-proxy-service.ts
...buildNoProxyEnv(['host.docker.internal'])

• Fixes [Duplicate Code] Proxy bypass environment assembly is repeated across container env builders #6357

[Copilot]

Pull request overview

Centralizes proxy-bypass environment construction to prevent drift across container services.

Changes:

• Adds shared NO_PROXY/no_proxy helpers.
• Refactors agent, API proxy, and CLI proxy environments without changing values.

Show a summary per file

File	Description
src/services/no-proxy-utils.ts	Adds shared bypass helpers.
src/services/api-proxy-env-config.ts	Uses shared baseline environment.
src/services/agent-environment/proxy-environment.ts	Collects bypass hosts before assembly.
src/services/cli-proxy-service.ts	Uses shared environment with host access.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Medium

[lpcox]

@copilot merge main

[Copilot]

@copilot merge main

Done — merged main (through ecff617b) into this branch. The merge was clean with no conflicts.

[github-actions]

✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓

[github-actions]

✅ Smoke Copilot BYOK AOAI (api-key) completed. Copilot AOAI BYOK (api-key) mode operational. 🔓

[github-actions]

✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟

[github-actions]

Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.

[github-actions]

✅ Build Test Suite completed successfully!

[github-actions]

✅ Smoke Claude passed

[github-actions]

✅ Contribution Check completed successfully!

[github-actions]

📰 VERDICT: Smoke Docker Sbx has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤

[github-actions]

✅ Smoke Copilot BYOK AOAI (Entra) completed. Copilot AOAI BYOK (Entra) mode operational. 🔓

[github-actions]

🔌 Smoke Services — All services reachable! ✅

[github-actions]

🚀 Security Guard has started processing this pull request

[github-actions]

⚠️ Coverage Regression Detected

This PR decreases test coverage. Please add tests to maintain coverage levels.

Overall Coverage

Metric	Base	PR	Delta
Lines	98.64%	98.68%	📈 +0.04%
Statements	98.46%	98.50%	📈 +0.04%
Functions	99.24%	99.24%	➡️ +0.00%
Branches	94.55%	94.53%	📉 -0.02%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
src/services/cli-proxy-service.ts	94.7% → 95.0% (+0.27%)	94.7% → 95.0% (+0.27%)
src/log-directory-setup.ts	96.2% → 100.0% (+3.78%)	96.3% → 100.0% (+3.71%)

✨ New Files (1 files)

• src/services/no-proxy-utils.ts: 100.0% lines

---

Coverage comparison generated by scripts/ci/compare-coverage.ts

[github-actions]

Please add tests for the new proxy-bypass helper and the updated environment builders. CONTRIBUTING.md asks contributors to "write tests for new functionality" and the PR process section says to include tests for new functionality. The PR description is clear and references #6357, so this looks good otherwise.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Contribution Check for #6371 · 1.78 AIC · ⊞ 20.9K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode ✅

Test	Result
GitHub MCP Connectivity	✅
GitHub.com Connectivity	✅ HTTP 200
File Write/Read	✅
BYOK Inference	✅

Status: PASS — Direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK report filed by Smoke Copilot BYOK
_{Add label ready-for-aw to run again}

[github-actions]

Smoke test: Copilot network isolation egress enforcement

EGRESS_RESULT allow=pass deny=pass

• ✅ Allowed domain (api.github.com): allowed=200
• ✅ Blocked domain (example.com): connection denied (403)

Overall: PASS — @lpcox

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• example.com

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "example.com"

See Network Configuration for more information.

🛡️ Egress verdict from Smoke Copilot Network Isolation
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot PAT Auth

Test	Result
GitHub MCP connectivity	✅ (MCP reachable)
GitHub.com HTTP	⚠️ pre-step data not injected
File write/read	⚠️ pre-step data not injected

⚠️ Template variables were not expanded — pre-computed test data unavailable.

Auth mode: PAT (COPILOT_GITHUB_TOKEN) | cc @lpcox | Overall: INDETERMINATE

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 PAT report filed by Smoke Copilot PAT
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Claude Engine Validation

Overall result: ✅ PASS

Check	Status
API	✅ PASS
GH	✅ PASS
File	✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Smoke Claude for #6371 · 35.3 AIC · ⊞ 3.3K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

🔥 Smoke Test Results

Test	Status
GitHub MCP connectivity	✅
GitHub.com HTTP	✅ 200
File write/read	✅

Overall: PASS

@lpcox

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📰 BREAKING: Report filed by Smoke Copilot
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test

• fix: don't mask Copilot CLI's ~/.copilot/config.json ✅
• fix(smoke-copilot): revert agent job to read-only perms to unblock CI ✅
• Overall status: PASS

Warning

Firewall blocked 2 domains

The following domains were blocked by the firewall during workflow execution:

• awmgmcpg
• registry.npmjs.org

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"
    - "registry.npmjs.org"

See Network Configuration for more information.

🔮 The oracle has spoken through Smoke Codex
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: Copilot BYOK (Direct) Mode (Azure OpenAI via Entra)
Context: AWF_AUTH_TYPE=github-oidc + AWF_AUTH_AZURE_* + COPILOT_PROVIDER_BASE_URL via api-proxy → Azure OpenAI (Foundry, o4-mini-aw) authenticated via Microsoft Entra

• GitHub MCP connectivity: ✅
• GitHub.com connectivity (HTTP 200/301): ✅
• File write/read test: ✅
• BYOK inference path: ✅

@lpcox Overall: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🪪 BYOK (AOAI Entra) report filed by Smoke Copilot BYOK AOAI (Entra)
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test Results: Gemini Engine

• GitHub MCP Testing: ✅ (Found 2 merged PRs: fix: don't mask Copilot CLI's ~/.copilot/config.json #6374, fix(smoke-copilot): revert agent job to read-only perms to unblock CI #6369 - Titles filtered)
• GitHub.com Connectivity: ✅ (HTTP 200)
• File Writing Testing: ✅
• Bash Tool Testing: ✅

Overall Status: PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• localhost

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "localhost"

See Network Configuration for more information.

💎 Faceted by Smoke Gemini
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: GitHub Actions Services Connectivity

Check	Result
Redis PING	❌ host.docker.internal DNS not resolving
PostgreSQL pg_isready	❌ No route to host
PostgreSQL SELECT 1	❌ Cannot translate hostname

Overall: FAIL

The AWF agent container runs in an isolated network (172.30.0.0/24) with no route to the Docker bridge or runner host. host.docker.internal is not resolvable from inside the sandbox.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔌 Service connectivity validated by Smoke Services
_{Add label ready-for-aw to run again}

[github-actions]

Smoke Test: API Proxy OpenTelemetry Tracing

Scenario	Result	Notes
1. Module Loading	✅	otel.js loads successfully; exports: startRequestSpan, setTokenAttributes, setBudgetAttributes, endSpan, endSpanError, shutdown, isEnabled, and internal helpers
2. Test Suite	✅	39 tests passed in otel.test.js; 20 tests passed in otel-fanout.test.js
3. Env Var Forwarding	✅	api-proxy-env-config.ts forwards GH_AW_OTLP_ENDPOINTS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_HEADERS, GITHUB_AW_OTEL_TRACE_ID, GITHUB_AW_OTEL_PARENT_SPAN_ID; observability-environment.ts auto-forwards all OTEL_* vars to agent
4. Token Tracker Integration	✅	onUsage callback exists in token-tracker-http.js (line 285, 343) as the OTEL hook point
5. OTEL Diagnostics	✅	FileSpanExporter used as graceful fallback when no OTLP endpoint configured (confirmed by otel-fanout tests)

All scenarios pass. OTEL tracing integration is functioning correctly.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

📡 OTel tracing validated by Smoke OTel Tracing
_{Add label ready-for-aw to run again}

[github-actions]

Chroot Version Comparison

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.13	Python 3.12.3	❌
Node.js	v24.18.0	v22.23.1	❌
Go	go1.22.12	go1.22.12	✅

⚠️ Not all versions match — smoke-chroot label not applied.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Tested by Smoke Chroot
_{Add label ready-for-aw to run again}

[github-actions]

$(sed s///g /tmp/gh-aw/agent/comment_body.txt)

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🔑 BYOK (AOAI api-key) report filed by Smoke Copilot BYOK AOAI (api-key)
_{Add label ready-for-aw to run again}

[github-actions]

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	1/1 passed	✅ PASS
Go	env	✅	1/1 passed	✅ PASS
Go	uuid	✅	1/1 passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Build Test Suite for #6371 · 31.4 AIC · ⊞ 7.1K · ◷
_{Add label ready-for-aw to run again}

[github-actions]

🔍 Smoke Test: Docker Sbx Validation

Test	Result
GitHub MCP Connectivity	✅ Connected (secrecy-filtered response)
GitHub.com HTTP	⚠️ Template not expanded
File Write/Read	⚠️ Template not expanded

Status: INCONCLUSIVE — Pre-computed step outputs (steps.smoke-data.outputs.*) were not injected into the prompt. MCP connectivity verified.

cc @lpcox

📰 BREAKING: Report filed by Smoke Docker Sbx
_{Add label ready-for-aw to run again}